steam-5fb[.]pages[.]dev

PhishDestroy identifies steam-5fb.pages.dev as an active Steam credential harvesting domain. This site impersonates Valve Corporation’s Steam platform to deceive users into surrendering login credentials. The domain is currently classified as an active threat and remains under active investigation by security teams.

steam-5fb.pages.dev was flagged by 11 of 95 VirusTotal vendors as of current analysis, indicating minimal detection coverage despite phishing behavior. The domain resolves to IP address 188.114.96.3, is registered through Cloudflare, Inc., and secured with a Let’s Encrypt SSL certificate. While the registration date is not disclosed, Cloudflare’s privacy protections obscure this detail. The IP address 188.114.96.3 hosts multiple suspicious domains and has a historically low trust score across threat intelligence platforms.

This domain remains active and poses a HIGH risk to users who interact with it. PhishDestroy recommends blocking access to steam-5fb.pages.dev at the network and endpoint levels. Users who may have entered credentials should immediately change their Steam password and enable two-factor authentication. Report the domain to your security team or via PhishDestroy’s submission portal. Monitor for follow-on phishing campaigns leveraging stolen credentials. Exercise caution with any unsolicited links referencing Steam or gaming authentication pages.